Mark, такая же проблема, и те же строки: шарит логины по всем траст доменам, несмотря на winbind use default domain = yes, allow trusted domains = no и подобные.Начинает напрягать с "ads_krb5_mk_req: krb5_cc_get_principal failed (No such file or directory)" при вводе в домен. При получении тикета все ура. А далее:
1. повторяющиеся строки "find_workgroup_on_subnet: workgroup search for $(my_short_name_domain) on subnet 10.130.129.33: found"
2. ads_try_connect: CLDAP request 10.243.223.10 failed
при wbinfo -u/g задержка (начинает шарить трастовые домены) и уже в нужном мне домене выводит список юзеров с выводом в winbindd.log, для каждого:
[2008/08/12 14:36:23, 1] nsswitch/winbindd_ads.c:query_user_list(209)
Not a user account? atype=0x30000000
$ uname -a
Linux test 2.6.18-1.2849.fc6 #1 SMP Fri Nov 10 12:36:14 EST 2006 i686 i686 i386 GNU/Linux
$ rpm -qa |grep -i -e ldap -e krb
krb5-devel-1.5-7
krb5-libs-1.5-7
pam_krb5-2.2.11-1
krb5-workstation-1.5-7
openldap-2.3.27-4
openldap-devel-2.3.27-4
nss_ldap-257-4.fc6
samba ставил из сырцов
$ smbd -V
Version 3.0.28a
$ cat /etc/hosts
::1 test localhost.localdomain localhost
127.0.0.1 test.main.domain.by localhost test
10.130.129.33 test.main.domain.by test
10.130.129.52 test
10.1.100.133 main.domain.by
$ping main.domain.by
PING main.domain.by (10.1.100.133) 56(84) bytes of data.
64 bytes from main.domain.by (10.1.100.133): icmp_seq=1 ttl=127 time=1.19 ms
64 bytes from main.domain.by (10.1.100.133): icmp_seq=2 ttl=127 time=0.436 ms
$ nslookup main.domain.by
Server: 10.1.100.133
Address: 10.1.100.133#53
Name: main.domain.by
Address: 10.130.129.100
Name: main.domain.by
Address: 10.1.100.133
Name: main.domain.by
Address: 10.254.0.2
Name: main.domain.by
Address: 10.1.100.181
Name: main.domain.by
Address: 10.1.100.182
Name: main.domain.by
Address: 10.144.129.30
Name: main.domain.by
Address: 10.254.0.3
$ grep -e "HAVE_KRB5 " -e "WITH_ADS" /home/user/samba-3.0.28a/source/include/config.h
#define HAVE_KRB5 1
#define WITH_ADS 1
# cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = MAIN.DOMAIN.BY
dns_lookup_realm = false
dns_lookup_kdc = false
# ticket_lifetime =
[realms]
MAIN.DOMAIN.BY = {
# admin_server = SRV-DC-002.MAIN.DOMAIN.BY
admin_server = 10.1.100.133
# kdc = SRV-DC-002.MAIN.DOMAIN.BY
kdc = 10.1.100.133
# kpasswd_server = SRV-DC-002.MAIN.DOMAIN.BY
kpasswd_server = 10.1.100.133
default_domain = MAIN.DOMAIN.BY
# main.domain.by
}
[domain_realm]
.main.domain.by = MAIN.DOMAIN.BY
main.domain.BY = MAIN.DOMAIN.BY
$ cat /usr/local/samba/lib/smb.conf | sed -e '/^$/d' -e '/^#/d' -e '/^;/d'
[global]
workgroup = DOMAIN
netbios name = test
server string = "test serv"
security = ads
hosts allow = 10. 127.
# load printers = yes
log file = /var/log/samba/%m.log
max log size = 50000
password server = 10.1.100.133
# and AD
encrypt passwords = yes
winbind uid = 10000-25000
winbind gid = 10000-25000
winbind enum groups = yes
winbind enum users = yes
realm = MAIN.DOMAIN.BY
passdb backend = tdbsam
local master = no
os level = 0
domain master = no
preferred master = no
domain logons = no
wins server = 10.1.100.100
wins proxy = no
dns proxy = no
winbind use default domain = yes
allow trusted domains = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
display charset = UTF-8
dos charset = CP866
unix charset = UTF-8
log level = 3
[share]
path = /data/public
read list =
write list =
read only = no
public = yes
writable = yes
browsable = yes
guest ok = yes
# cat /etc/nsswitch.conf | grep winbind
group: files winbind
passwd: files winbind
shadow: files winbind
Итак:
все вроде как прописано. Получаю билет под рутом для своего юзера из AD (не имеющего право вводить в домен), ntpd запущен, для уверенности предварительно синхронизируемся с сервером
# net time set -> OK
# kinit my_domain_user@MAIN.DOMAIN.BY
Password for my_domain_user@MAIN.DOMAIN.BY:
получаем, смотрю вывод klist.
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: my_domain_user@MAIN.DOMAIN.BY
Valid starting Expires Service principal
08/07/08 09:34:33 08/07/08 19:35:14 krbtgt/MAIN.DOMAIN.BY@MAIN.DOMAIN.BY
renew until 08/14/08 09:34:33
08/07/08 09:35:14 08/07/08 19:35:14 test$@MAIN.DOMAIN.BY
renew until 08/14/08 09:34:33
Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached
далее adminDomain вводит в домен:
# net ads join -U adminDomain%password
Using short domain name -- DOMAIN
Joined 'test' to realm 'MAIN.DOMAIN.BY'
# smbd -D
# winbindd -i -d3
# nmbd -D
Проверяем:
# wbinfo -t
checking the trust secret via RPC calls succeeded
# wbinfo -p
Ping to winbindd succeeded on fd 4
# wbinfo -D DOMAIN
Name : DOMAIN
Alt_Name : MAIN.DOMAIN.BY
SID : S-1-5-21-1549627856-163330409-526660263
Active Directory : Yes
Native : Yes
Primary : Yes
Sequence : -1
Mark, если решишь проблему, стукни в асю 287-667-338, в любом случае, скилл пригодиться
Извенюсь за большой пост, но тема та же, и трабла. Спасибо
